podsec

Overview ¶

Package podsec analyzes pod specs (and their controlling workloads) for container-runtime security issues like privileged containers, host namespace sharing, sensitive hostPath mounts, and insecure image tags.

Content for pod-security findings. Each rule has a builder that takes runtime context (workload kind/namespace/name, container name, hostPath path) and returns an enriched ruleContent with scope-aware language, an attacker walkthrough, ordered remediation steps, and structured references / MITRE technique citations.

Sources: Kubernetes Pod Security Standards, NSA/CISA Kubernetes Hardening Guide v1.2, MITRE ATT&CK Containers matrix, Microsoft Threat Matrix for Kubernetes, Bishop Fox Bad Pods, KubeHound, Aqua Security writeups, Quarkslab "HostPath: Love-Hate Relationship", The Grey Corner containerd research, Christophe Tafani-Dereeper "Stop worrying about allowPrivilegeEscalation".